Merge branch 'wagov:main' into main

CharlesRN · Nov 1, 2024 · c4ef686 · c4ef686
2 parents 062ed0b + 2623198
commit c4ef686
Show file tree

Hide file tree

Showing 12 changed files with 246 additions and 10 deletions.
diff --git a/docs/advisories/20241024001-Fortinet-Critical-Vulnerabilities.md b/docs/advisories/20241024001-Fortinet-Critical-Vulnerabilities.md
@@ -8,15 +8,17 @@ The WA SOC has been made aware of a critical vulnerability in Fortinet FortiMana
 
 ## What is vulnerable?
 
-| Product(s) Affected | Affected Version(s)                                                                                                                                                               | Severity | CVE                                                               | CVSS |
-| ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ----------------------------------------------------------------- | ---- |
-| FortiManager        | all versions \< 7.6.0 <br> versions \< 7.4.0 - 7.4.4 <br>versions \< 7.2.0 - 7.2.7  <br>versions \< 7.0.0 - 7.0.12 <br>versions \< 6.4.0 - 6.4.14 <br> versions \< 6.2.0 - 6.2.12 | Critical | [CVE-2024-47575](https://nvd.nist.gov/vuln/detail/CVE-2024-47575) | 9.8  |
-| Fortimanager Cloud  | versions \< 7.4.1 - 7.4.4 <br> versions \< 7.2.1 - 7.2.7 <br>versions \< 7.0.1 - 7.0.12  <br>all versions \< 6.4                                                                  | Critical | [CVE-2024-47575](https://nvd.nist.gov/vuln/detail/CVE-2024-47575) | 9.8  |
+| Product(s) Affected | Affected Version(s)                                                                                  | CVE                                                               | CVSS | Severity |
+| ------------------- | ---------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- | ---- | -------- |
+| FortiManager        | 7.6 - 7.6.0 <br> 7.4 - 7.4.4 <br> 7.2 - 7.2.7  <br> 7.0 - 7.0.12 <br> 6.4 - 6.4.14 <br> 6.2 - 6.2.12 | [CVE-2024-47575](https://nvd.nist.gov/vuln/detail/CVE-2024-47575) | 9.8  | Critical |
+| Fortimanager Cloud  | 7.4.1 - 7.4.4 <br> 7.2.1 - 7.2.7 <br> 7.0.1 - 7.0.12  <br> all versions 6.4.x                        | [CVE-2024-47575](https://nvd.nist.gov/vuln/detail/CVE-2024-47575) | 9.8  | Critical |
 
 ## What has been observed?
 
 There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing.
 
+Fortinet has updated their security advisory addressing this vulnerability to include additional workarounds and indicators of compromise (IOCs).
+
 ## Recommendation
 
 The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of *48 hours...* (refer [Patch Management](../guidelines/patch-management.md)):
@@ -26,3 +28,8 @@ The WA SOC recommends administrators apply the solutions as per vendor instructi
 ## Other Information
 
 - ACSC: <https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/vulnerability-in-fortinets-fortimanager>
+
+### Change Log
+
+- 2024-10-24: Advisory initial creation.
+- 2024-10-31: Update "What has been observed" with new information from vendor. Update "What is vulnerable" version information.
diff --git a/docs/advisories/20241025001-Cisco-Critical-Vulnerabilities.md b/docs/advisories/20241025001-Cisco-Critical-Vulnerabilities.md
@@ -0,0 +1,29 @@
+# Cisco Addresses Critical Vulnerabilities - 20241025001
+
+## Overview
+
+The WA SOC has been made aware to critical vulnerabilities affecting Cisco systems that could enable an authenticated remote attacker to execute operating system commands with root privileges.
+
+## What is vulnerable?
+
+| Product(s) Affected                           | Version(s)                 | CVE                                                               | CVSS | Severity     |
+| --------------------------------------------- | -------------------------- | ----------------------------------------------------------------- | ---- | ------------ |
+| Cisco Secure Firewall Management Center (FMC) | all versions \<= 7.4.2     | [CVE-2024-20424](https://nvd.nist.gov/vuln/detail/CVE-2024-20424) | 9.9  | **Critical** |
+| Cisco Adaptive Security Appliance (ASA)       | all versions \<= 9.18.3.56 | [CVE-2024-20329](https://nvd.nist.gov/vuln/detail/CVE-2024-20329) | 9.9  | **Critical** |
+| Cisco Firepower Threat Defense (FTD)          | all versions \<= 7.4.1.1   | [CVE-2024-20412](https://nvd.nist.gov/vuln/detail/CVE-2024-20412) | 9.3  | **Critical** |
+
+## What has been observed?
+
+There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing.
+
+## Recommendation
+
+The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of *48 hours...* (refer [Patch Management](../guidelines/patch-management.md)):
+
+- Cisco advisory CVE-2024-20424: <https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ssh-rce-gRAuPEUF>
+- Cisco advisory CVE-2024-20329: <https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-cmd-inj-v3AWDqN7>
+- Cisco advisory CVE-2024-20412: <https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-statcred-dFC8tXT5>
+
+## Additional References
+
+- Security Affairs article: <https://securityaffairs.com/170203/breaking-news/cisco-fixed-tens-of-vulnerabilities-including-actively-exploited-one.html>
diff --git a/docs/advisories/20241028001-New-ICS-Advisories.md b/docs/advisories/20241028001-New-ICS-Advisories.md
@@ -0,0 +1,16 @@
+# New ICS Advisories - 20241028001
+
+## Overview
+
+Rockwell and Siemens have released advisories for critical vulnerabilities in their Industrial Control Systems (ICS) products.
+
+## What is vulnerable?
+
+| Vendor              | Advisory                                                                                                                                         |
+| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
+| Rockwell Automation | [SD 1708 - ThinManager Multiple Vulnerabilities](https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1708.html) |
+| Siemens             | [SSA-333468: Multiple Vulnerabilities in InterMesh Subscriber Devices](https://cert-portal.siemens.com/productcert/html/ssa-333468.html)         |
+
+## Recommendation
+
+The WA SOC recommends administrators review relevant advisories and apply the recommended actions to all affected devices.
diff --git a/docs/advisories/20241029001-Progress-WhatsUp-Critical-Update.md b/docs/advisories/20241029001-Progress-WhatsUp-Critical-Update.md
@@ -0,0 +1,25 @@
+# Progress WhatsUp Critical Update - 20241029001
+
+## Overview
+
+The WA SOC has been made aware about a critical vulnerability in certain WhatsUp Gold versions, having an Authentication Bypass issue which allows an attacker to obtain encrypted user credentials.
+
+## What is vulnerable?
+
+| Product(s) Affected | Version(s)                   | CVE                                                             | CVSS | Severity     |
+| ------------------- | ---------------------------- | --------------------------------------------------------------- | ---- | ------------ |
+| WhatsUp Gold        | All versions before 2024.0.0 | [CVE-2024-7763](https://nvd.nist.gov/vuln/detail/CVE-2024-7763) | 9.8  | **Critical** |
+
+## What has been observed?
+
+There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing.
+
+## Recommendation
+
+The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of *48 hours* (refer [Patch Management](../guidelines/patch-management.md)):
+
+- Progress: <https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024>
+
+## Additional References
+
+- SecurityOnline: <https://securityonline.info/whatsup-gold-users-beware-critical-authentication-bypass-flaw-exposed-cve-2024-7763-cvss-9-8/>
diff --git a/docs/advisories/20241030001-Apple-Critical-Update.md b/docs/advisories/20241030001-Apple-Critical-Update.md
@@ -0,0 +1,26 @@
+# Apple Critical Update - 20241030001
+
+## Overview
+
+Apple has released updates for multiple products. The WA SOC has been made aware of some vulnerabilities being classified as critical.
+
+## What is vulnerable?
+
+| Product(s) Affected | Version(s)           | CVE                                                               | CVSS | Severity     |
+| ------------------- | -------------------- | ----------------------------------------------------------------- | ---- | ------------ |
+| iOS and iPadOS      | all versions \< 18.1 | [CVE-2024-40867](https://nvd.nist.gov/vuln/detail/CVE-2024-40867) | 9.6  | **Critical** |
+
+## What has been observed?
+
+There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing.
+
+## Recommendation
+
+The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of *48 hours...* (refer [Patch Management](../guidelines/patch-management.md)):
+
+- Apple October iOS and iPadOS 18.1 Release Notes: <https://support.apple.com/en-us/121563>
+- Apple Security Realses Overview: <https://support.apple.com/en-us/100100>
+
+## Additional References
+
+- SecurityOnline article: <https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-apple-products-could-allow-for-arbitrary-code-execution_2024-121>
diff --git a/docs/advisories/20241030002-QNAP-Critical-Advisory.md b/docs/advisories/20241030002-QNAP-Critical-Advisory.md
@@ -0,0 +1,25 @@
+# QNAP Zero-Day Vulnerability - 20241030002
+
+## Overview
+
+An OS command injection vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands.
+
+## What is vulnerable?
+
+| Product(s) Affected      | Version(s)         | CVE                                                               | CVSS | Severity     |
+| ------------------------ | ------------------ | ----------------------------------------------------------------- | ---- | ------------ |
+| HBS 3 Hybrid Backup Sync | 25.1 \< 25.1.1.673 | [CVE-2024-50388](https://nvd.nist.gov/vuln/detail/CVE-2024-50388) | TBA  | **Critical** |
+
+## What has been observed?
+
+There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing.
+
+## Recommendation
+
+The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of *48 hours...* (refer [Patch Management](../guidelines/patch-management.md)):
+
+- QNAP: <https://www.qnap.com/en-us/security-advisory/qsa-24-41>
+
+## Additional References
+
+- Tenable: <https://www.tenable.com/cve/CVE-2024-50388>
diff --git a/docs/advisories/20241030003-Spring-Webflux-Vulnerability.md b/docs/advisories/20241030003-Spring-Webflux-Vulnerability.md
@@ -0,0 +1,25 @@
+# Spring WebFlux Critical Advisory - 20241030003
+
+## Overview
+
+Spring Security have disclosed an vulnerability that enables an “authorisation bypass of static resources in WebFlux applications” under specific conditions. If exploited, this vulnerability could potentially allow unauthorized access to static resources, undermining application security.
+
+## What is vulnerable?
+
+| Product(s) Affected | Version(s)                                                                                                       | CVE                                                               | CVSS | Severity     |
+| ------------------- | ---------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- | ---- | ------------ |
+| Spring WebFlux      | 5.7.0 - 5.7.12 <br> 5.8.0 - 5.8.14 <br> 6.0.0 - 6.0.12 <br> 6.1.0 - 6.1.10 <br> 6.2.0 - 6.2.6 <br> 6.3.0 - 6.3.3 | [CVE-2024-38821](https://nvd.nist.gov/vuln/detail/CVE-2024-38821) | 9.1  | **Critical** |
+
+## What has been observed?
+
+There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing.
+
+## Recommendation
+
+The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of *48 hours...* (refer [Patch Management](../guidelines/patch-management.md)):
+
+- Spring: <https://spring.io/security/cve-2024-38821>
+
+## Additional References
+
+- SecurityOnline: <https://securityonline.info/cve-2024-38821-cvss-9-1-allows-authorization-bypass-in-webflux-applications/>
diff --git a/docs/advisories/20241030004-New-ICS-Advisories.md b/docs/advisories/20241030004-New-ICS-Advisories.md
@@ -0,0 +1,19 @@
+# New ICS Advisories - 20241030004
+
+## Overview
+
+CISA have released advisories for critical vulnerabilities relating to Industrial Control Systems (ICS) products.
+
+## What is vulnerable?
+
+| Vendor            |
+| ----------------- |
+| Siemens           |
+| Solar-Log         |
+| Delta Electronics |
+
+## Recommendation
+
+The WA SOC recommends administrators review relevant advisories and apply the recommended actions to all affected devices.
+
+- CISA: <https://www.cisa.gov/news-events/alerts/2024/10/29/cisa-releases-three-industrial-control-systems-advisories>
diff --git a/docs/advisories/20241031001-Google-Chrome-Critical-Updates.md b/docs/advisories/20241031001-Google-Chrome-Critical-Updates.md
@@ -0,0 +1,25 @@
+# Google Chrome Critical Updates - 20241031001
+
+## Overview
+
+Google has released a new stable channel update for their Chrome browser addressing multiple vulnerabilities. Successful exploitation could allow a remote attacker to perform malicious activity via a crafted HTML page.
+
+## What is vulnerable?
+
+| Product(s) Affected | Affected Version(s)              | CVE                                                                                                                                      | CVSS         | Severity                       |
+| ------------------- | -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ------------------------------ |
+| Google Chrome       | All versions below 130.0.6723.92 | [CVE-2024-10487](https://nvd.nist.gov/vuln/detail/CVE-2024-10487) <br> [CVE-2024-10488](https://nvd.nist.gov/vuln/detail/CVE-2024-10488) | 9.8 <br> 9.8 | **Critical** <br> **Critical** |
+
+## What has been observed?
+
+There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing.
+
+## Recommendation
+
+The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of *48 hours...* (refer [Patch Management](../guidelines/patch-management.md)):
+
+- Google: <https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_29.html>
+
+## Additional References
+
+- SecurityOnline article: <https://securityonline.info/new-chrome-security-patch-targets-critical-cve-2024-10487-10488-flaws-update-immediately/>
diff --git a/docs/advisories/20241031002-IBM-Critical-Update.md b/docs/advisories/20241031002-IBM-Critical-Update.md
@@ -0,0 +1,21 @@
+# IBM Critical Update - 20241031002
+
+## Overview
+
+A critical vulnerability has been identified in IBM Power Systems servers. The IBM Flexible Service Processor (FSP) contains static credentials that could enable network users to obtain service privileges on the FSP.
+
+## What is vulnerable?
+
+| Product(s) Affected            | Version(s)                                                                                                                    | CVE                                                               | CVSS | Severity     |
+| ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- | ---- | ------------ |
+| IBM Flexible Service Processor | FW1060.00 - FW1060.10 <br> FW1050.00 - FW1050.21 <br> FW1030.00 - FW1030.61 <br> FW950.00 - FW950.C0 <br> FW860.00 - FW860.B3 | [CVE-2024-45656](https://nvd.nist.gov/vuln/detail/CVE-2024-45656) | 9.8  | **Critical** |
+
+## What has been observed?
+
+There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing.
+
+## Recommendation
+
+The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of *48 hours...* (refer [Patch Management](../guidelines/patch-management.md)):
+
+- IBM: <https://www.ibm.com/support/pages/node/7174183>
diff --git a/docs/advisories/20241101002-New-ICS-Advisories.md b/docs/advisories/20241101002-New-ICS-Advisories.md
@@ -0,0 +1,18 @@
+# New ICS Advisories - 20241101002
+
+## Overview
+
+CISA have released advisories for critical vulnerabilities relating to Industrial Control Systems (ICS) products.
+
+## What is vulnerable?
+
+| Vendor              |
+| ------------------- |
+| Rockwell Automation |
+| Mitsubishi Electric |
+
+## Recommendation
+
+The WA SOC recommends administrators review relevant advisories and apply the recommended actions to all affected devices.
+
+- CISA: <https://www.cisa.gov/news-events/alerts/2024/10/31/cisa-releases-four-industrial-control-systems-advisories>
diff --git a/docs/markdown-templates/Advisory-vulnerability.md b/docs/markdown-templates/Advisory-vulnerability.md
@@ -1,4 +1,4 @@
-# \[Advisory Title\] - 2024MMDD000
+# Advisory Title - 2024MMDD000
 
 ## Overview
 
@@ -8,10 +8,10 @@ Describe the threat to organisation's application/ environment/ security/ operat
 
 ## What is vulnerable?
 
-| Product(s) Affected | Version(s) | CVE                                                                                                                                       | CVSS          | Severity                                                         |
-| ------------------- | ---------- | ----------------------------------------------------------------------------------------------------------------------------------------- | ------------- | ---------------------------------------------------------------- |
-| Product Name 1      | Version    | [CVE-xxxx-xxxxx](https://nvd.nist.gov/vuln/detail/CVE-xxxx-xxxxx)                                                                         | X.X           | Low/Medium/High/**Critical**                                     |
-| Product Name 2      | Version    | [CVE-xxxx-xxxxx](https://nvd.nist.gov/vuln/detail/CVE-xxxx-xxxxx) </br> [CVE-xxxx-xxxxx](https://nvd.nist.gov/vuln/detail/CVE-xxxx-xxxxx) | X.X </br> X.X | Low/Medium/High/**Critical**  </br> Low/Medium/High/**Critical** |
+| Product(s) Affected | Version(s) | CVE                                                                                                                                      | CVSS         | Severity                                                        |
+| ------------------- | ---------- | ---------------------------------------------------------------------------------------------------------------------------------------- | ------------ | --------------------------------------------------------------- |
+| Product Name 1      | Version    | [CVE-xxxx-xxxxx](https://nvd.nist.gov/vuln/detail/CVE-xxxx-xxxxx)                                                                        | X.X          | Low/Medium/High/**Critical**                                    |
+| Product Name 2      | Version    | [CVE-xxxx-xxxxx](https://nvd.nist.gov/vuln/detail/CVE-xxxx-xxxxx) <br> [CVE-xxxx-xxxxx](https://nvd.nist.gov/vuln/detail/CVE-xxxx-xxxxx) | X.X <br> X.X | Low/Medium/High/**Critical**  <br> Low/Medium/High/**Critical** |
 
 ## What has been observed?
 
@@ -21,7 +21,7 @@ There is no evidence of exploitation affecting Western Australian Government net
 
 The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of *48 hours...* (refer [Patch Management](../guidelines/patch-management.md)):
 
-- \<Direct_Vendor_URL>
+- Vendor: <URL>
 
 ## Additional References